Description
Drag and Drop XBlock v2 implements a drag-and-drop style problem, where a learner has to drag items to zones on a target image. Versions prior to 3.0.0 are vulnerable to cross-site scripting in multiple XBlock Fields. Any platform that has deployed the XBlock may be impacted. Version 3.0.0 contains a patch for this issue. There are no known workarounds.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
openedx xblock-drag-and-drop-v2
< 3.0.0affected
References
- https://github.com/openedx/xblock-drag-and-drop-v2/security/advisories/GHSA-qv6c-367r-3w6q ↗
- https://github.com/openedx/xblock-drag-and-drop-v2/pull/295#issuecomment-1277693864 ↗
- https://github.com/openedx/xblock-drag-and-drop-v2/commit/68887d1b4a44325d2de7573d450e41129ba98b1a ↗
- https://github.com/openedx/xblock-drag-and-drop-v2/releases/tag/v3.0.0 ↗